eZ Platform Object Injection in SiteAccessMatchListener
This Security Advisory is about an object injection vulnerability in the SiteAccessMatchListener of eZ Platform, which could lead to remote code execution (RCE), a very serious threat. All sites may be affected.
Update: There are bugs introduced by this fix, particularly but not limited to compound siteaccess matchers. These have been fixed in ezsystems/ezplatform-kernel v1.0.3, and in ezsystems/ezpublish-kernel v7.5.8, v6.13.6.4, and v5.4.15.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Composer package | ezsystems/ezplatform-kernel | >= 1.0.0, < 1.0.3 | 1.0.3 |
References
- https://ezplatform.com/security-advisories/ezsa-2020-004-object-injection-in-siteaccessmatchlistener
- https://github.com/FriendsOfPHP/security-advisories/blob/master/ezsystems/ezplatform-kernel/2020-05-20-1.yaml
- https://github.com/ezsystems/ezplatform-kernel
- https://web.archive.org/web/20201024030303/https://ezplatform.com/security-advisories/ezsa-2020-004-object-injection-in-siteaccessmatchlistener
- Weakness (CWE)
CWE-94- Platform
- Composer
- Package
ezsystems/ezplatform-kernel- Disclosed
- 15.05.2024
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-2w9p-xxqr-h253 - CC BY 4.0
Vulnerability history: ezsystems/ezplatform-kernel
All published vulnerabilities of this package (Composer package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 10
- First → latest
- 03.2021 05.2024
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- Critical 3
- High 3
- Medium 2
- Low 2
Disclosures per year
- 2021: 1
- 2022: 4
- 2023: 3
- 2024: 2
- 2025: 0
- 2026: 0
-
eZ Platform Object Injection in SiteAccessMatchListener this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.